Dynamic access policy provisioning in a device fog
Various systems and methods for dynamic access policy provisioning in a connected device framework are described herein. In an example, the techniques for policy provisioning may include resource update access policy automation, directory resource access policy automation, or hidden resources access policy automation, as monitored and operated with an access management service (AMS). In an example, the AMS monitors resources to receive a notification when they change. If the change observed is an addition or deletion of a resource object, the AMS responds by performing security analysis of devices hosting the new resource(s), which may further result in device onboarding actions. The AMS may further respond by evaluating link semantics to determine which other devices and resources may need updated access control list (ACL) policies.
1. An apparatus comprising:
memory; and
machine executable instructions; and
programmable circuitry to at least one of instantiate or execute the machine executable instructions to at least:
identify a creation of a resource based on a first specific command output by a resource host and observed on an Internet of things (IoT) network, the first specific command performed with a device to create the resource, the resource not accessible on the IoT network, the identification of the creation based on a change to (a) a directory or (b) collection resource managing a plurality of resources and devices within the IoT network based on the creation of the resource;
generate a first access control entry based on the creation, the first access control entry to include matching criteria corresponding to access to the resource by a subject client, the first access control entry to provide access to the resource according to the directory or the collection resource;
identify a deletion of the resource that is not accessible on the IoT network, the deletion identified based on a second specific command output by the resource host and observed on the IoT network, the second specific command referencing the resource;
generate a second access control entry based on the deletion; and
cause transmission of the second access control entry to the resource host.
2. The apparatus of claim 1 , wherein the first specific command is a create command.
3. The apparatus of claim 1 , wherein the programmable circuitry is to identify the change in response to a notification.
4. The apparatus of claim 1 , wherein the change is an anticipated change.
5. The apparatus of claim 1 , wherein the resource is in a collection hosted by the resource host.
6. The apparatus of claim 5 , wherein the collection includes one or more links to respective resources of the IoT network.
7. The apparatus of claim 1 , wherein the matching criteria includes at least one of (a) a subject matching criterion corresponding to a first applicability of the first access control entry to the subject client or (b) a resource matching criterion corresponding to a second applicability of the first access control entry to the resource, the subject matching criterion identifying the subject client based on at least one of identity, role, a first wildcard, or a subject resource, the resource matching criterion identifying the resource based on at least one of a second wildcard, a reference, a resource type, an interface, or attributes defined by a link structure.
8. The apparatus of claim 1 , wherein the programmable circuitry is unaware of the resource prior to the observation of the first specific command on the IoT network.
9. The apparatus of claim 1 , wherein the first specific command does not identify the programmable circuitry.
10. The apparatus of claim 1 , wherein the first specific command does not identify the programmable circuitry.
11. The apparatus of claim 1 , wherein the resource is a hidden resource.
12. A non-transitory computer readable storage medium comprising instructions to cause one or more processors to at least:
identify a creation of a resource based on a first specific command output by a resource host and observed on an Internet of things (IoT) network, the first specific command performed with a device to create the resource, the resource not accessible on the IoT network, the identification of the creation based on a change to (a) a directory or (b) collection resource managing a plurality of resources and devices within the IoT network based on the creation of the resource;
generate a first access control entry based on the creation, the first access control entry to include matching criteria corresponding to access to the resource by a subject client, the first access control entry to provide access to the resource according to the directory or the collection resource;
identify a change to the resource that is not accessible on the IoT network, the change identified based on a second specific command output by the resource host and observed on the IoT network, the second specific command referencing the resource;
generate a second access control entry based on the identified change; and
cause transmission of the second access control entry to the resource host.
13. The non-transitory computer readable storage medium of claim 12 , wherein the first specific command is a create command.
14. The non-transitory computer readable storage medium of claim 12 , wherein the instructions cause the one or more processors to identify the change in response to a notification.
15. The non-transitory computer readable storage medium of claim 12 , wherein the change is an anticipated change.
16. The non-transitory computer readable storage medium of claim 12 , wherein the change to the resource corresponds to at least one of a change, an update, or a deletion of the resource in a collection hosted by the resource host.
17. The non-transitory computer readable storage medium of claim 16 , wherein the collection includes one or more links to respective resources of the IoT network.
18. The non-transitory computer readable storage medium of claim 12 , wherein the matching criteria includes at least one of (a) a subject matching criterion corresponding to a first applicability of the first access control entry to the subject client or (b) a resource matching criterion corresponding to a second applicability of the first access control entry to the resource, the subject matching criterion identifying the subject client based on at least one of identity, role, a first wildcard, or a subject resource, the resource matching criterion identifying the resource based on at least one of a second wildcard, a reference, a resource type, an interface, or attributes defined by a link structure.
19. The non-transitory computer readable storage medium of claim 12 , wherein the resource is a hidden resource.
20. A method comprising:
identifying, by executing an instruction with one or more processors, a creation of a resource based on a first specific command output by a resource host and observed on an Internet of things (IoT) network, the first specific command performed with a device to create the resource, the resource not accessible on the IoT network, the identification of the creation based on a change to (a) a directory or (b) collection resource managing a plurality of resources and devices within the IoT network based on the creation of the resource;
generate a first access control entry based on the creation, the first access control entry to include matching criteria corresponding to access to the resource by a subject client, the first access control entry to provide access to the resource according to the directory or the collection resource;
identifying, by executing an instruction with the one or more processors, an update of the resource that is not accessible on the IoT network, the update identified based on a second specific command output by the resource host and observed on the IoT network, the second specific command referencing the resource;
generating, by executing an instruction with the one or more processors, a second access control entry based on the update; and
transmitting the second access control entry to the resource host.
21. The method of claim 20 , wherein the first specific command is a create command.
22. The method of claim 20 , further including identifying the change in response to a notification.
23. The method of claim 20 , wherein the change is an anticipated change.
24. The method of claim 20 , wherein the update to the resource corresponds to at least one of a change or a deletion of the resource in a collection hosted by the resource host.
25. The method of claim 20 , wherein the matching criteria includes at least one of (a) a subject matching criterion corresponding to a first applicability of the first access control entry to the subject client or (b) a resource matching criterion corresponding to a second applicability of the first access control entry to the resource, the subject matching criterion identifying the subject client based on at least one of identity, role, a first wildcard, or a subject resource, the resource matching criterion identifying the resource based on at least one of a second wildcard, a reference, a resource type, an interface, or attributes defined by a link structure.